Another failed (?) attempt to fix iroute.
Finally seem to have gotten iroute to work.
Fortuitously, OpenVPN ships with *two* sample client certificates, so there is no need to go through the painful process of generating new ones.